1. Who we are and when this policy applies
This Privacy Policy explains how Rui Miguel Reis Carvalho, operating as Fuse Labs, a sole proprietorship based in Ontario, Canada ("Fuse Labs," "we," "us" or "our"), handles personal information in connection with Surion, Surion AI, Surion accounts, subscriptions, support and the Surion website.
Fuse Labs is the controller of the personal information described in this policy except where we process limited team information solely on the instructions of a Studio customer. This policy does not govern third-party services that you connect directly to Surion using your own account, credentials or API key.
2. Surion is local-first
Surion is designed so that website projects, source code, assets, previews, local-model prompts and outputs remain on your Mac when you use local features. Fuse Labs does not receive those materials merely because you create, open, edit, inspect, preview or export a local project.
Project content leaves your Mac only when you deliberately use an online feature, such as Surion AI, a user-supplied API, GitHub, FTP, a support submission that includes files, or another connected service. The destination and processing depend on the feature you choose.
3. Information we collect
Depending on how you use Surion, we may collect the following categories of information:
- Download information, including the email address you provide to receive the free version of Surion.
- Paid-account information managed through Clerk, including email address, authentication identifiers, account status, organization and team membership.
- Transaction records and identifiers received from Stripe, including plan, amount, currency, payment status, invoice or transaction identifier, and applicable tax information. Fuse Labs does not receive or store complete payment-card details.
- Installation and licensing information: license and subscription status, a machine identifier, macOS version, Surion version and machine specifications.
- Support information you choose to provide, such as your email address, message, screenshots, project excerpts, diagnostic files or other attachments.
- Website information, including IP address, browser and device information, pages viewed, referrer, approximate country, currency and consent choices.
- Team-administration information, including invitations, seat assignments, roles, member Surion AI access status, member spending limits, member-level credit usage totals, credit-increase requests and optional reasons supplied with those requests, and actions taken by authorized Studio administrators.
4. How we use information
We use personal information only for defined business and legal purposes, including:
- Delivering Surion, download links, accounts, subscriptions, licensing, updates and requested services.
- Authenticating users, administering teams and preventing unauthorized access or license abuse.
- Processing transactions, maintaining accounting records, handling refunds and complying with tax and financial obligations.
- Responding to support requests and reviewing diagnostics that a user voluntarily submits.
- Operating, securing, debugging and improving Surion and the website using limited installation and consented analytics data.
- Sending essential account, security, service, subscription and usage notices. Marketing will require a separate lawful basis and an unsubscribe mechanism if introduced.
- Establishing, exercising or defending legal claims and complying with lawful requests.
5. Legal bases
Where applicable law requires a legal basis, we rely on performance of a contract to provide accounts, paid plans and requested features; consent for non-essential analytics, voluntary diagnostics and any future marketing; legitimate interests in licensing, security, support, fraud prevention, service improvement and business continuity; and legal obligations for accounting, tax, regulatory and lawful-request compliance.
You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal and does not prevent processing supported by another lawful basis.
6. Free downloads and email addresses
An account is not required to use the Free plan, but an email address is required to receive the download. Supabase stores download-email records for delivery, security notices, compatibility notices, installation support and legitimate business continuity.
We may retain a download-email record while Surion remains available and the record remains reasonably necessary for those purposes, subject to periodic review and your right to request deletion. We do not use a download email for unrelated marketing without any consent required by law.
7. Accounts, payments and teams
Paid users must create an account. Clerk provides authentication, Supabase supports service databases, and Stripe processes subscription payments. Stripe retains payment information under its own privacy terms; Fuse Labs retains transaction records and identifiers needed to administer subscriptions and meet legal obligations.
An authorized Studio administrator may invite users, assign seats, manage roles, see membership and license status, enable or disable Surion AI, set spending limits, reset usage counters, view member-level credit usage totals, review credit-increase requests and remove users from its organization. A request reason is visible to authorized organization administrators, so members should not include confidential project content. These controls do not give the administrator access to a member’s private local project files, prompt content or generated output. Team members should direct organization-specific access questions to their administrator.
8. Installation data and voluntary diagnostics
Surion transmits license and subscription status, a machine identifier, macOS version, Surion version and machine specifications for activation, installation measurement, compatibility, security and support. This operational data does not include project names, filenames, source code, prompts, documents or website content.
Diagnostic reports are not transmitted automatically. If you choose to provide diagnostics or attachments to support, we use them only to investigate the request, secure and improve Surion, and communicate with you. Review submitted material and remove information you do not want to share.
9. Surion AI
Surion AI is an optional online service powered through third-party model APIs operated by OpenAI and Anthropic. When you invoke Surion AI, the information required for that request may be transmitted for processing, including prompts, conversation context, selected or relevant files, code, project structure, screenshots, previews, images, PDFs, build or console errors and generated output.
Fuse Labs does not retain Surion AI prompts, project content or outputs after processing, does not use them to train models, and does not permit routine human review by Fuse Labs personnel. OpenAI and Anthropic process the content as independent service providers under their commercial API terms. Fuse Labs does not currently have zero-data-retention agreements with either provider. Their standard API controls may retain inputs, outputs or abuse-monitoring information for up to 30 days, and in limited cases longer where required for safety, policy enforcement or law.
Do not submit information you lack the right to process or information requiring protections that Surion AI and its listed providers are not contractually configured to provide.
10. Your API keys and direct integrations
API keys and integration credentials are stored in macOS Keychain and may synchronize through Apple services according to your Apple Account and device settings. Fuse Labs does not receive those secrets.
Requests made using your own OpenAI, Anthropic, Google or Perplexity API credentials travel directly from your Mac to the selected provider. GitHub and FTP connections likewise communicate directly with the account, repository or server you configure. Fuse Labs does not proxy, intercept or store those requests, credentials, repository contents or server files. Your use is governed by the third party's terms and privacy policy.
12. Service providers
We use carefully selected providers only as needed to operate Surion and the website:
- Clerk: authentication and account management.
- Supabase: service databases and storage of download-email records; the production region is expected to be in the United States unless otherwise selected.
- Stripe: subscription payments, billing, tax and transaction processing.
- OpenAI and Anthropic: processing requested Surion AI operations.
- PostHog: consented website analytics.
- Namecheap: website hosting and routine hosting infrastructure, which may generate security and access logs.
- ipapi.co and Frankfurter: approximate location, currency and reference exchange-rate services.
- Email and support infrastructure used to deliver downloads, authentication messages, service notices and support replies.
13. When information is disclosed
We disclose personal information to the providers above only as necessary to perform their services, to professional advisers bound by confidentiality, to authorities when legally required, or to protect users, Fuse Labs and the public from fraud, abuse or security threats.
Fuse Labs does not sell personal information, disclose it to data brokers, or share it for cross-context behavioural advertising. If Fuse Labs or Surion is reorganized, financed, sold or transferred, relevant records may be disclosed under appropriate confidentiality and transferred as part of that transaction, subject to applicable law and the commitments in this policy.
14. International processing
Fuse Labs operates from Canada and offers Surion worldwide. Providers may process information in Canada, the United States, the European Economic Area and other locations where they or their subprocessors operate. Privacy protections in those places may differ from those where you live.
Where required, we rely on adequacy decisions, contractual safeguards or other lawful transfer mechanisms. Fuse Labs currently has no establishment or appointed privacy representative in the European Union or United Kingdom. Rui Miguel Reis Carvalho's Portuguese citizenship does not by itself create an EU business establishment. Individuals may contact Fuse Labs directly while we assess and implement any representative appointment required for the scale and nature of our processing.
15. Retention
We retain information only for the period reasonably necessary for its stated purpose, subject to legal holds and mandatory law. Our current retention framework is:
- Active account information: for the account's lifetime.
- Closed-account information: deleted or anonymized within 30 days, except records that must be retained.
- Backups: removed through normal rotation within 90 days.
- Voluntarily submitted diagnostics: 90 days unless needed longer to resolve the request.
- Support correspondence: 24 months after resolution.
- Installation and licensing records: account or license lifetime plus 12 months.
- Security logs: ordinarily 90 days.
- Download-email records: while Surion remains available and the record remains reasonably necessary, subject to deletion rights and periodic review.
- Transaction, accounting and tax records: at least six years after the relevant Canadian tax year or longer where legally required.
- Dispute or investigation records: until final resolution and expiration of applicable limitation periods.
16. Security
We use reasonable administrative, technical and organizational measures appropriate to the nature of the information, including access controls, least-privilege practices, encryption in transit, provider security controls, macOS Keychain for local secrets, account authentication and procedures for responding to suspected incidents.
No system is completely secure. You are responsible for securing your Mac, Apple Account, Surion credentials, API-provider accounts, repositories and servers. If a breach creates a legally reportable risk, Fuse Labs will notify affected individuals and regulators as required by law.
17. Your privacy rights
Depending on where you live, you may have rights to know or access personal information, correct inaccurate information, obtain a portable copy, delete information, restrict or object to processing, withdraw consent, opt out of sale or targeted advertising, and appeal a refused request. Because Fuse Labs does not sell personal information or use it for targeted advertising, there is no sale or advertising sharing from which to opt out.
You may delete eligible account data through available account controls or contact support@fuselabssoftware.com. We may verify your identity before completing a request. We will respond within the period required by applicable law and explain any lawful exception. You may complain to the Office of the Privacy Commissioner of Canada, an applicable provincial commissioner, or the privacy authority where you live.
18. Business and Studio customers
A Studio customer determines how its organization uses Surion and is responsible for having lawful authority to manage its members, projects and connected systems. For limited organization data processed solely to provide team administration, Fuse Labs acts on the customer's documented instructions and the customer acts as controller or business, as those terms are defined by applicable law.
This allocation does not make Fuse Labs responsible for a customer's unlawful projects, instructions or use. Each party remains responsible for its own conduct and legal obligations. Where required, Fuse Labs will make a data processing addendum available to eligible business customers.
19. Age requirement
Surion, its accounts and subscriptions are not directed to children. You must be at least 18 years old and have reached the age of majority where you live to download, create an account for, subscribe to or use Surion. If we learn that we collected personal information from an ineligible minor, we will delete it as required by law.
20. Changes to this policy
We may update this policy to reflect changes to Surion, providers or legal requirements. We will post the revised policy with a new effective date and provide additional notice through the website, Surion or account email when a change materially affects your rights. Previous processing remains governed by the policy and law applicable at the time.
21. Contact
Privacy questions and requests may be sent to support@fuselabssoftware.com.
Rui Miguel Reis Carvalho, operating as Fuse Labs, 302B–230 Woolner Avenue, York, Ontario M6N 1Y7, Canada. Email is the designated privacy contact method; telephone support is not offered for privacy requests.